Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-77375 · GHSA-q7pc-356p-hggc

SFTPGo: Denial of service via malformed SSH channel request

Risk score
48/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has…
Affected
github.com/drakkan/sftpgo/v2 (go) <= 2.7.4
Fix
Upgrade github.com/drakkan/sftpgo/v2 to 2.7.5 or later.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 6.5 medium
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/drakkan/sftpgo/v2go<= 2.7.42.7.5

References

Original description

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified. This issue is fixed in 2.7.5.

Last activity 13 Oct 2026. Patch Forecast updates every hour.